org.bouncycastle.math.ec.test

Class ECConstantTimeMultiplierTest

java.lang.Object

junit.framework.Assert

junit.framework.TestCase

org.bouncycastle.math.ec.test.ECConstantTimeMultiplierTest

All Implemented Interfaces:

junit.framework.Test

public class ECConstantTimeMultiplierTest
extends junit.framework.TestCase

Differential tests for ECConstantTimeMultiplier.

The multiplier exists to remove a timing side channel, not to compute anything new, so its output must agree exactly with the existing multipliers for every scalar. That is what is checked here, against ECAlgorithms.referenceMultiply(org.bouncycastle.math.ec.ECPoint, java.math.BigInteger) (plain double-and-add) and against whatever multiplier the curve is configured with, across every named curve - which covers the Fp custom curves, the generic Fp curves, the binary (F2m) curves, and the GLV curve secp256k1 whose endomorphism this multiplier deliberately bypasses.

The scalars are not only random: the recoding forces the scalar odd, splits it into fixed-width signed odd digits and relies on no digit being zero and on the accumulator never colliding with a table entry, so the boundary values below (1, 2, order-1, powers of two, values either side of a window boundary) are the cases most likely to break those assumptions.

Constructor Summary

Constructors

Constructor and Description
ECConstantTimeMultiplierTest()

Method Summary

Modifier and Type	Method and Description
void	testAgainstReferenceOnAllNamedCurves()
void	testBasePoint() The base point is a legitimate input too, even though the fixed-base comb would normally be used for it - a caller cannot be assumed to know which point it holds.
void	testOutOfSubgroupPointSemantics() The subgroup precondition, pinned: the odd-forcing step computes (k + n)P in place of an even kP, which is the same point exactly when the order of P divides n.
void	testRejectsEvenOrder()
void	testRejectsScalarLargerThanOrder()
void	testSignAndInfinityHandling()

Methods inherited from class junit.framework.TestCase

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, countTestCases, createResult, fail, fail, failNotEquals, failNotSame, failSame, format, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

ECConstantTimeMultiplierTest

public ECConstantTimeMultiplierTest()

Method Detail

testAgainstReferenceOnAllNamedCurves

public void testAgainstReferenceOnAllNamedCurves()

testBasePoint

public void testBasePoint()

The base point is a legitimate input too, even though the fixed-base comb would normally be used for it - a caller cannot be assumed to know which point it holds.

testSignAndInfinityHandling

public void testSignAndInfinityHandling()

testOutOfSubgroupPointSemantics

public void testOutOfSubgroupPointSemantics()

The subgroup precondition, pinned: the odd-forcing step computes (k + n)P in place of an even kP, which is the same point exactly when the order of P divides n. For a point outside the order-n subgroup the result therefore differs from plain multiplication by nP on even scalars - deliberate, documented behaviour, asserted here so a change to the recoding shows up. sect163k1 (cofactor 2) supplies both an order-2 point - (0, 1), since y^2 + xy = x^3 + x^2 + 1 forces y = 1 at x = 0 - and a full-order point, G + (0, 1).

testRejectsEvenOrder

public void testRejectsEvenOrder()

testRejectsScalarLargerThanOrder

public void testRejectsScalarLargerThanOrder()